Identity is an important component enabling interactions in everyday life. For example, an individual's credit card enables merchants to identify and allow the individual to purchase products and services on credit. The same is true in the digital world as well, where digital identity enables digital interactions. For example, digital identities can be used to authenticate parties to each other in the digital environment. Knowing with whom one is interacting is an important element in deciding whether or not to trust and provide information to a party.
An entity can use a digital identity to authenticate a party's identity or other personal information about the party. A digital identity can be issued by another entity and include information about the party. Examples of such information include the party's name, address, social security number, age, telephone number, etc. A party can have multiple digital identities issued by one or more other entities, similar to that of an individual having a driver's license, a credit card, and a frequent flyer card.
The party can use a digital identity to identity itself to a third party. For example, a third party, such as an online service, can require that the party authenticate its identity before the third party allows the party to access goods or services. In order to authenticate its identity, the party can forward to the third party a digital identity in the form of a security token issued by another entity trusted by the third party. Once authentication is complete, the third party can provide access to the goods or services requested by the party.
In many cases, the party has little or no ability to control or view the contents of a security token issued by another entity. When the party shares a security token with a third party during authentication of the party's identity, the party's privacy can become a concern. For example, without knowledge of the contents of the security token, the party can unknowingly share personal information in the security token with the third party that the party does not need to share for authentication. In addition, the party can unknowingly provide personal information that the party does not want to share with the third party (e.g., social security number, telephone number, etc.).